I am using Sitecore 9.1 with Identity Server configured to authenticate users against Azure Active Directory. This works great and users can login with their azure accounts without issue.
I have installed Sitecore Powershell 5.0 and am using it successfully as an administrator. All script integrations are present and have been rebuilt successfully.
I have added this configuration to my Sitecore authoring instance:
<?xml version="1.0" encoding="utf-8"?> <configuration xmlns:patch="http://www.sitecore.net/xmlconfig/"> <sitecore> <pipelines> <owin.cookieAuthentication.validateIdentity> <processor type="Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.ValidateIdentity.ValidateSiteNeutralPaths, Sitecore.Owin.Authentication"> <siteNeutralPaths hint="list"> <path hint="spe">/sitecore%20modules/PowerShell</path> </siteNeutralPaths> </processor> </owin.cookieAuthentication.validateIdentity> </pipelines> <powershell> <services> <execution> <authorization> <patch:delete /> </authorization> <authorization> <add name="author" Permission="Allow" IdentityType="Role" Identity="sitecore\ScriptUserRole" /> <add name="administrator" Permission="Allow" IdentityType="Role" Identity="sitecore\IsAdministrator" /> </authorization> </execution> </services> </powershell> </sitecore> </configuration>
Now, when I create a local Sitecore user with the role of
sitecore\ScriptUserRole, I can login as this user and see all script integrations appropriately.
When I create another role (e.g.,
sitecore\PowerUser) which inherits from
sitecore\ScriptUserRole and login with a local user assigned to the
sitecore\PowerUser role, I can see all script integrations appropriately.
When I map an Azure role to either the PowerUser or ScriptUserRole and login via Azure AD (via this blog post), I can see that all native Sitecore access rights are functioning properly. However, I cannot see any script integration points.
Is there any additional configuration required for Sitecore Powershell that gets it working with federated Identity users?